ServiceAuthorizationManager.CheckAccess Method

Definition

Namespace:

System.ServiceModel

Assembly:

System.ServiceModel.dll

Checks authorization for the given operation context and optional message.

Overloads

CheckAccess(OperationContext)	Checks authorization for the given operation context.
CheckAccess(OperationContext, Message)	Checks authorization for the given operation context when access to a message is required.

CheckAccess(OperationContext)

Checks authorization for the given operation context.

C#

public virtual bool CheckAccess(System.ServiceModel.OperationContext operationContext);

Parameters

operationContext

OperationContext

The OperationContext.

Returns

Boolean

true if access is granted; otherwise, false. The default is true.

Examples

The following code shows how to override this method to enforce custom access control requirements.

C#

public class myServiceAuthorizationManager : ServiceAuthorizationManager
{
    // Override the CheckAccess method to enforce access control requirements.
    public override bool CheckAccess(OperationContext operationContext)
    {
        AuthorizationContext authContext =
        operationContext.ServiceSecurityContext.AuthorizationContext;
        if (authContext.ClaimSets == null) return false;
        if (authContext.ClaimSets.Count != 1) return false;
        ClaimSet myClaimSet = authContext.ClaimSets[0];
        if (!IssuedBySTS_B(myClaimSet)) return false;
        if (myClaimSet.Count != 1) return false;
        Claim myClaim = myClaimSet[0];
        if (myClaim.ClaimType ==
          "http://www.tmpuri.org:accessAuthorized")
        {
            string resource = myClaim.Resource as string;
            if (resource == null) return false;
            if (resource != "true") return false;
            return true;
        }
        else
        {
            return false;
        }
    }

    // This helper method checks whether SAML Token was issued by STS-B.
    // It compares the Thumbprint Claim of the Issuer against the
    // Certificate of STS-B.
    private bool IssuedBySTS_B(ClaimSet myClaimSet)
    {
        ClaimSet issuerClaimSet = myClaimSet.Issuer;
        if (issuerClaimSet == null) return false;
        if (issuerClaimSet.Count != 1) return false;
        Claim issuerClaim = issuerClaimSet[0];
        if (issuerClaim.ClaimType != ClaimTypes.Thumbprint)
            return false;
        if (issuerClaim.Resource == null) return false;
        byte[] claimThumbprint = (byte[])issuerClaim.Resource;
        // It is assumed that stsB_Certificate is a variable of type
        // X509Certificate2 that is initialized with the Certificate of
        // STS-B.
        X509Certificate2 stsB_Certificate = GetStsBCertificate();
        byte[] certThumbprint = stsB_Certificate.GetCertHash();
        if (claimThumbprint.Length != certThumbprint.Length)
            return false;
        for (int i = 0; i < claimThumbprint.Length; i++)
        {
            if (claimThumbprint[i] != certThumbprint[i]) return false;
        }
        return true;
    }

Remarks

In general, applications should override CheckAccessCore instead of this method.

Override CheckAccess if the application associates or introduces a different set of policies for the resulting ServiceSecurityContext or provide a different policy evaluation (chaining) model.

This method is responsible for calling CheckAccessCore.

CheckAccess(OperationContext, Message)

Checks authorization for the given operation context when access to a message is required.

C#

public virtual bool CheckAccess(System.ServiceModel.OperationContext operationContext, ref System.ServiceModel.Channels.Message message);

Parameters

operationContext

OperationContext

The OperationContext.

message

Message

The Message to be examined to determine authorization.

Returns

Boolean

true if access is granted; otherwise, false. The default is true.

Examples

The following code shows how to override this method to enforce custom access control requirements that require access to the message body.

C#

public class myService_M_AuthorizationManager : ServiceAuthorizationManager
{
    // set max size for message
    int someMaxSize = 16000;
    protected override bool CheckAccessCore(OperationContext operationContext, ref Message message)
    {
        bool accessAllowed = false;
        MessageBuffer requestBuffer = message.CreateBufferedCopy(someMaxSize);

        // do access checks using the message parameter value and set accessAllowed appropriately
        if (accessAllowed)
        {
            // replace incoming message with fresh copy since accessing the message consumes it
            message = requestBuffer.CreateMessage();
        }
        return accessAllowed;
    }
}

Remarks

In general, applications should override CheckAccessCore instead of this method, which should only be used if the authorization decision depends on the message body. Because of performance issues, if possible you should redesign your application so that the authorization decision does not require access to the message body.

Override this method if the application associates or introduces a different set of policies for the resulting ServiceSecurityContext and Message or provide a different policy evaluation (chaining) model.

This method is responsible for calling CheckAccessCore.